Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The app explanation for it will be 'path can hook into your address book' - presumably for sending invites or messages to friends. However at this point the cat's out the bag and path can do what they like with this data (albeit against app store policy).

The problem is surely one of governance - it must be that the app reviewers simply don't (whether through sheer volume of apps they have to review, or lack of ability) see what's being posted, and where.

What's more if Path used https and a CA, would we ever have found out what was being posted short of live debugging?



The address book is uploaded using TLS/SSL and the author used mitmproxy.


D'oh. Would this man-in-the-middle attack have worked if path validated against a CA or stored cert and only submitted the data when it was sure it wasn't being snooped on?


I've come across the latter, but it's not a difficult thing to get around if you're willing to play with the binary. You might be able to recognize the stored cert and sub it out with your own, or you can just ensure the branch that validates it never runs.


Presumably Apple could demand the ability to change the certificate an app validated against for testing purposes, if Apple cared enough to do that.


Nope. Turns out Siri was (at least originally, not sure if it still is) vulnerable to the same attack.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: